Automattic

Automattic Privacy Policy: User Overview

*This summary is based only on the text provided. Several sections appear incomplete—particularly the lists of specific information collected, purposes of use, sharing circumstances, and the change log—so the full policy may contain additional details.*

1. Data Collection and Use

Automattic may collect information from:

• You directly: Information submitted when creating an account, using Services, making purchases, posting content, contacting support, or applying for a job.
• Automatically: IP address, browser and operating system details, device identifiers, usage activity, cookies, approximate location, and server logs.
• Other sources: Login providers such as Google; Stripe information for WooPayments/WooPay; Google Ad Manager and Analytics data for Newspack; and third parties that may provide mailing addresses for marketing.

The policy identifies categories including:

• Name, email, contact and online identifiers
• Billing and purchase information
• Internet activity and site-administration activity
• Approximate geolocation
• Profile images and other audio/visual information
• Employment, education, and job-application information
• Inferences such as likely retention or attrition

Automattic says it uses data to:

• Provide, administer, secure, and improve Services
• Process payments and manage accounts
• Communicate with users and provide support
• Personalize experiences and measure advertising
• Detect problems, fraud, vulnerabilities, and abuse
• Conduct recruitment and evaluate job applicants
• Comply with law and protect vital interests

For EU/UK users, stated legal bases include contract performance, legal obligations, vital interests, legitimate interests, and consent.

2. User Rights and Choices

Depending on location, users may have rights to:

• Access personal data
• Correct inaccurate data
• Delete data
• Object to or restrict processing
• Receive portable copies of data
• Opt out of certain sale/sharing for advertising or analytics
• Avoid discriminatory treatment for exercising privacy rights
• Complain to a data-protection regulator

Requests may be made through account tools or Automattic’s web form/email. Identity verification is required, and an authorized agent may act for a user with written authorization.

Automattic may deny requests where identity cannot be verified or retention is legally required. Certain US users may appeal a denial; job applicants are excluded from that appeal process.

The “Do Not Sell or Share” opt-out is cookie-based, meaning it may need to be repeated after deleting cookies, changing browsers, or visiting from another browser. Automattic says it recognizes the Global Privacy Control signal.

3. Third-Party Sharing

Information may be shared with:

• Service providers and processors supporting hosting, payments, security, analytics, advertising, communications, and other operations
• Advertising networks and analytics companies using cookies or similar tracking technologies
• Payment providers, particularly Stripe
• Connected services such as Google
• Third-party plugins, embeds, Woo extensions, and other software selected by users
• Firehose subscribers receiving streams of public posts and comments
• Authorities or other parties when legally necessary

Third-party services have their own privacy policies, which Automattic does not control. A significant risk is that installing a plugin, pixel, cookie, or integration may expose data belonging not only to the user but also to site visitors or customers.

Automattic may transfer data internationally, including outside the EEA or UK, using safeguards such as approved standard contractual clauses.

4. AI/ML Training

The provided policy does not expressly state whether user data, public content, usage data, or customer content is used to train artificial-intelligence or machine-learning models. Users should not assume that the policy prohibits such use. The stated purposes—improving Services, personalization, analytics, and making inferences—could potentially involve automated analysis, but no specific AI-training commitment is provided.

5. Key User Responsibilities and Risks

• Content deliberately made public—including profiles, posts, comments, Likes, and Gravatars—may be indexed by search engines, displayed elsewhere, or analyzed by third parties.
• Public data may be distributed through the Firehose. An opt-out is mentioned for certain WordPress.com and Jetpack sites.
• Users should avoid posting sensitive information publicly.
• Users are responsible for reviewing third-party privacy practices before enabling plugins, embeds, payment tools, or integrations.
• Users operating websites are expected to publish an accurate privacy policy for information collected from their visitors.
• Automattic encourages two-step authentication but does not guarantee complete security.
• Deleted content may remain in Trash for 30 days and later persist temporarily in backups or caches.

6. Liability and Disputes

This privacy policy provides little detail about liability limits, warranties, indemnities, governing law, arbitration, or dispute procedures. Those issues are likely addressed in the applicable Terms of Service rather than this policy.

Automattic states that no online service is completely secure and only promises “reasonable” protective measures. Disputes about content on a user’s website should generally be directed to that site owner, not Automattic.

7. Policy Changes

Automattic may revise the policy periodically. Notice may consist of:

• Updating the change log
• A homepage or WordPress.com Blog notice
• Email or dashboard notification in some cases

Continued use of the Services after changes means the updated policy applies. The English version controls if it conflicts with a translation.